Linux kernel drm/xe: userptr inject path takes notifier_lock for read, tripping a GPU SVM lock assertion
Impact
On Intel Xe GPU driver builds, xe_pt_svm_userptr_pre_commit() ran the userptr invalidation-injection path while holding the SVM notifier_lock for read, while drm_gpusvm_unmap_pages() assumes the caller holds it for write. The result is a lock-mode violation reachable from a VM bind ioctl, producing a kernel warning and unsound locking around GPU shared-virtual-memory page unmapping. The important qualifier is in the fix itself: this only occurs when CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y, a fault-injection test option, and the upstream change states production builds with that option off keep the previous behaviour bit-for-bit. Stock distribution and vendor kernels do not enable that option, so for almost every operating fleet this is a test-configuration bug rather than a live exposure - verify your own kernel config before scheduling anything.
Who can reach it
Local user with access to an Intel Xe GPU device node who can issue a VM bind ioctl, and only on a kernel built with the fault-injection Kconfig enabled. No remote reach.
What to do
Check whether your kernel sets CONFIG_DRM_XE_USERPTR_INVAL_INJECT; if it is not set, no action is required. If you build kernels with fault injection enabled (CI or driver-development machines), take a stable kernel containing the fix and reboot those hosts, draining GPU work first. The record lists the stable commits but no fixed release number, so confirm against your kernel tree rather than assuming a version.
References
Related entries
- Linux kernel drm/vmwgfx: unvalidated offsets and strides overrun imported dma-buf maps in BO copyCVE-2026-80700 · Linux kernel drm/vmwgfx (vmw_external_bo_copy stride and offset validation)High
- Linux kernel drm/vmwgfx: boolean written to guest_memory_size drives out-of-bounds MOB dirty walksCVE-2026-80702 · Linux kernel drm/vmwgfx (vmw_resource guest_memory_size clobbered by boolean assignment)High
- nouveau UVMM: failed sparse-unmap bind job frees a live VA region, leading to use-after-freeCVE-2026-89801 · Linux kernel nouveau UVMM (nouveau_uvmm_bind_job_submit OP_UNMAP_SPARSE error paths)High
- nouveau: channel-kill event stays subscribed after the fence context is freed, racing teardownCVE-2026-89803 · Linux kernel nouveau (nouveau_channel_del teardown ordering, channel-kill event)High
- drm_pagemap: use-after-put in the device-to-RAM migration error path, plus missing THP fallbackCVE-2026-89805 · Linux kernel drm_pagemap (drm_pagemap_migrate_populate_ram_pfn folio fallback)High
- amdkfd: uninitialized return on a hole in the migrated range drops VRAM pages just allocatedCVE-2026-89808 · Linux kernel amdkfd (svm_migrate_copy_to_vram, hole in the migration VM range)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.